From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Wed, 21 Oct 2026 15:46:15 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pl1-f184.google.com (mail-pl1-f184.google.com [209.85.214.184]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 69LDkDYJ014851 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 21 Oct 2026 15:46:14 +0200 Received: by mail-pl1-f184.google.com with SMTP id d9443c01a7336-2d02df2bf09sf5867835ad.0 for ; Wed, 21 Oct 2026 06:46:14 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1792590368; cv=pass; d=google.com; s=arc-20260327; b=IQx6hXkJqnRnpUEDLmd71Qpxfw5lAiGsX9sYmGL4e68M1ep3Wr4Ffa3u7FIytsZABO 4t6Gl/eMn9fSc2xmfa0j060qFlwRW7uKaWaWAE8DipdsdVOxv9FSMEpZ4tCBZt1hrKzx P+5eTXJiD6rCq3d50scrrepe3Qw94H9nfX5bBE2j4ltCYMYzRFsWRVLa9NXzH8zws/pu YGi+iyAyhEKHZi9f9l6vOeX4W0krCba/Rj34BwcKLdC9JbJDjP3GJp/a4dZZRiOz+tAW l5RY+mRWbgLSjeLhhRrgFRtgaI2t7zR7NMrNlnhMRU0xy9+7uw3z/sR3WnEmQ8IONgTE kCcw== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:message-id :date:subject:cc:to:from:dkim-signature; bh=chvK/tRzSzuxl0/fP2SYH5H+FFnhhpZqdynvoxPVugA=; fh=FMMRFeKvlA0pFy22QddHeg9WQgzdMBtwW9bpzYHhWic=; b=Ly/32Urg8qklrpuPV/Aq2y2voKyHoUGVhblYRi69A/UMSpl69l21RUQBiY7lR0fnO+ mZTU6cqeOvON2wsqmZwaqwubeb/YvPlTN+70jDx/EichIOv9tH8Gsd48U3qInk4f++4g z4teWQ8ZU3e58DJxfmmgtkJDucrwOxOnnhoPZTiCZSInIVnq9lFPIQCVKtho6LBNYpFc X5/YOXJio0NTa4GRFcPzoCHlZpfddaIEg5mjLnzoCuju4Y2Q7jWegKEUlzRt0GYyxdZE FGrP1JCcWEiWe5ftnxxY/LSR1PU8m3DyB7atItXtiwV8pqGETSlXxM8oakkZQGaSaIjF FBow==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=r5VP6vLy; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1792590368; x=1793195168; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=chvK/tRzSzuxl0/fP2SYH5H+FFnhhpZqdynvoxPVugA=; b=TgMtVHCqouNAHCSXMqAzGZ1N5iNLnPlIlxGCLO8A60IDrHD+YorpxvuX04nLmCETzK MDxH620seA8Use1C3jouCvNYWJA6qpNZ8X8pyM5Kb1Kl7IaRnTKO50MNgmZAVrw+o9rf iBkAjSj+M4kcYJNSOhcZlBPgQoVJt20qIOnKQNvPRkddb3+cG845RuAJDtEKGR5k1YeL anL4UwJIxXADmkP7ucK2FGqvYe6ZmswxyboBHNtpB8/7ljI8mO3Pr9FLPYVUq4uZ2VQj XvDc7zd8H2nzkTK+q+tj+f1ws2jegS28+NKSmBZ8BhE7YhWNDt6LqEfTSSutWE3suztJ zzQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792590368; x=1793195168; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:x-beenthere :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=chvK/tRzSzuxl0/fP2SYH5H+FFnhhpZqdynvoxPVugA=; b=NtG/xogBsaiqSieY8k3JCZhkoeZaUMhOKWOCjoBP2YddwbGMJVDhSKwxxjN+fym4TE Mn0rxmqYHHzN/C/cJKs43hDAvdnhRWTSdq2gf7rxrZhqvYu4/Z7HMENlydDDMAEKy69l IZW0YmFsxUFgzcuh2qDHp4LV9Oj0SOrEgvG33KOwUDjzd/DA70l54atXd60b3hLE9mzd qDYEAqZUOjKNItTuQnPGOk6HsVAlfzlw0W82lY0qrSRr/2oEcoe9xh3p9Fq7RLJKk3eP N6UAlFBfHYl8VTwlfgkh+CLVjhnVDOFkajrGEFLn1t27rX48K+Uzoi/o5lzdzqp4nfru luSw== X-Forwarded-Encrypted: i=3; AKwUvBztlTrjJtqOkwl3bFbOqxoYaGV0zAsiL3DVQ+AzxpncPaTZukPFnJCPK0XkF/28W7jGA1AM@ilbers.de X-Gm-Message-State: AFq9FYIu3ramsL5p6JSwd5XIluA5qeVrdGC9QyodIyJIZX+e4A7zLoKY rv6kCcGLf9ssulo26PGHx1ZZJge8jStZWFFfb1Wea/XMYT03XxFizaTz X-Received: by 2002:a17:902:c951:b0:2e2:ffcb:87a9 with SMTP id d9443c01a7336-2ea43e4ed82mr15365365ad.24.1792590367431; Wed, 21 Oct 2026 06:46:07 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdflYlx4bFrSKS+BkXB+RVKyDX9q60CHmU0RvQRzS/AUrg==" Received: by 2002:a17:903:1a85:b0:2e8:2ac4:56f0 with SMTP id d9443c01a7336-2ea3bbe30bfls14290475ad.1.-pod-prod-02-us; Wed, 21 Oct 2026 06:46:06 -0700 (PDT) X-Received: by 2002:a05:6a20:431c:b0:3de:5a00:e248 with SMTP id adf61e73a8af0-3e287f471b2mr1439104637.76.1792590365827; Wed, 21 Oct 2026 06:46:05 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1792590365; cv=pass; d=google.com; s=arc-20260327; b=dNDrzz6uLg+Y6bssejatQhCDgLtuArUf9D+An5Wi/qFg9n5KRO9EUippzUJXqRCWuT 4h6R1rhowu7bYfA6e9qXCtUzz2VZFnJktFc1hl07D+loj4Som4RHagbQazHrjqRNxhFn GNqN8FeDtJ5pO6+IcoyrWrlnZwqmQ7axleYjE5zTJ+D6A2sD3/tj1+tKyHlq/erVt1gv 3rUSHTC2RKX5c+i07pCSWB9dIznDRrDo8MWLNRh9Cf70J5NRHN5yQeBw15AtBCJFdsmv PgdDn4SVRBjLGS78znTSvbN7NDdVf8KLsvUMxI1hMRDH0I+18gEoUL3FcX7UW8eyufWY +6KA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:dkim-signature; bh=dk8CJLzGjlz7m/m431BJQ7y6pofX66J6zWf4sy/MCXc=; fh=6+bCjj6jzibbKRpyyYepFBsRZzL3ccbQ5hqSvj0947A=; b=YsjEl+UbyVZzF8PmxYcYJnaulgNYDFSPuMB4xT05s7GO4Y8lu1Flzvxza3FqHpi1pn ivUJquKXQfttRPEOOcZUpHgcSO8Hw9opUNn5Y6hRbTJ/AbNw9AU0nufLGnNfQiNXMyLq YQ2gZeUB52b1ScBCitLIvT23jK39itwqSgbq/q2+/FvmTo5BrOsHVg/QwqxrOYZyWHE4 VyAgGi9d7QwUk4pXjlV7HUIBieX5AcpqgrG5RSZH95sFu6d0N9W55JP0d7gIqIjF8kbv NwodoMEC9Oyl10hOTnaTvx+0TSuNWOSQHlk4FkXwC2pNQcYH0lygCUvPhCQf9jPMtN/Q M8lg==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=r5VP6vLy; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c200::3]) by gmr-mx.google.com with ESMTPS id d2e1a72fcca58-8a0895c296bsi45638b3a.4.2026.10.21.06.46.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Oct 2026 06:46:05 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) client-ip=2a01:111:f403:c200::3; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mfh65efNKDSmDdZjNCRnsbhcIWBbmPaK/C4bThQz2DUXDoJ2X3Qyw3kb37qiW7RhLq9zVCznjBwhztlGwvigIgK/xmnXWiO3zM4mDm+VKCD+s+K1ZdThrfa+4t3gUjhR4tf08YE+4cOAkrpsRGHYjlXwzwbHUCIJmcpUk6DCV/1zcldnx9jhC6UxP02okkHipBmgi/iXPhfAM1D0ZVGBrUuFJ+Nn6sPOTVjY7plTbV5ZvK3W0gwJ6uvKwmxhND2lpv2lYtpwd8gZq0hBijyPEjDpu7+ReRCNr5NXenrTN4tRUU9WrWCXcQgGCzhSdalYt0Q+g79d9lAq8/UmbLsDqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dk8CJLzGjlz7m/m431BJQ7y6pofX66J6zWf4sy/MCXc=; b=b9Tq3oTiruoRbWKEpUQSy1RW02rKwBulrI6f8fArVkN+2B/kUer+hUhRkA5hcookw/ZvtugnOjRHSN9/6vexuOiMiLr3ZMczEsAawUPthphQlf/KEFp9IwZiP13iaPHQ25WDAPItpo4jMdIt+gZAPXaMBg84A6j/XKW7n+932mG8pfJmOwOSp794lqwgmQbg/dE7pehEOZ/nLddlAcCMXUGKzSX+7qBZsFcJJPO6siLU8SRPZsWtMhPDwUmd8uxYjURWQ6kCqrpuCavyW70dymwoUSsA/p4C/e9RBxKItv1sOqmcrzjmNkomBiar0kzCRSanxSWYirZi4XUW22cu9Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) by PAWPR10MB7771.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:363::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Wed, 21 Oct 2026 13:46:02 +0000 Received: from AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c]) by AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM ([fe80::c54c:ccd8:ebbf:477c%3]) with mapi id 15.21.0522.017; Wed, 21 Oct 2026 13:46:01 +0000 From: "'Felix Moessbauer' via isar-users" To: isar-users@googlegroups.com Cc: clara.kowalsky@siemens.com, Felix Moessbauer Subject: [RFC 1/1] test-container: block sudo usage on rootless Date: Wed, 21 Oct 2026 15:45:40 +0200 Message-ID: <20261021134540.331832-1-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.55.0 Content-Type: text/plain; charset="UTF-8" X-ClientProxiedBy: FR4P281CA0065.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:ce::8) To AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:17e::10) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM7PR10MB3956:EE_|PAWPR10MB7771:EE_ X-MS-Office365-Filtering-Correlation-Id: fb78b078-5654-40a5-d164-08df2f79a518 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024|23010399003|261009223027099003|10067099003|56012099006|6133799003|55112099003|18002099003|11063799006; X-Microsoft-Antispam-Message-Info: y9mt0RRGMM6rIsWXAAOQ/Q0s1aSYLVEFLeA55cOKhUUQ9/kgFN2OojyqhK0eh1B4WyvyZI/0R/TnjWHGso+l8PDQdLRVb8n/aDidYAx95DtZYjwnWd9UY0F6J74nqAAufMj2xf6gGU7wAE+74dNkmt7PZ5+iFcQJSzYWndjAWyy9iyNd/9rM2fMAFWn1IpOAVqmha0iJp0UDWPAAvpCtJ61UQMXc2HQnz6AtE2w0HJfskzGxXgRQN/XDhd7OmhKre6JmRYYf8OP3dkYkPHxQ/dXXmkFcDNz8lAoRHZ3kfiB7+bOAaBOzXx1pwydPhKPfXtuvey25iPZOr+YfML7x/Qk5wo1SF8uNlvyjJL1FHdBJl3X/ogokhVFHm6qq+oCyGSZeQXoLBOWZsM+oOhyJg4/RFKlhY8fel5fVNfbSVmU4KxdZilrJdCWXALt5DqP8VauRVCTL/sKt9rJhVNcw3B7ZZU0AicGcUnf0iSCXSxrEjqg5smWp1IcODkp5W2yR217ZmEKhMOHGMOiOGMAYNtET/6f9O6caUPj5703ltNpIJ5Shaa0+ZqlXeeDqMjvLxAETlGD7iDQomlMdxogeyl+b5Cg6S6r3xixy+XCpbhRwcbEYTR6gN/OBd+dEyuF/QciM7BhKHHhEyzvsm2rU/JDlMhS/VKDwWP3hmoWZEK0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(23010399003)(261009223027099003)(10067099003)(56012099006)(6133799003)(55112099003)(18002099003)(11063799006);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?OYjzQ9yYLsjFyJ0hmfJ7leiEbuaMtN2PpPVVpd38RmfN9ry5O3+dBoZHKi+z?= =?us-ascii?Q?ZcJUMmV+2I8m8MgcFMOF+1WvHunM1TA7xM8LGprwaGCatbOkZ3Ofk6vEQp4P?= =?us-ascii?Q?JECVEs3OSlU22z21Iic/YmxIlnOh7CH9iL7qNiJpLiYeCYnpGbic24ZmURFf?= =?us-ascii?Q?bpv+rML9r38wwf4s2fcM8nVMk4v5ZcluATXstYO8TCZfw1tQrqM7zIVHtX0P?= =?us-ascii?Q?LcasvL+ssBctXxfO/v+173/9sO8HCaodFUagP8t63K0CAnnmGkWhkpDCUp6j?= =?us-ascii?Q?CMygVjTy8H30Il7a7Hs9Os/OCenuKs3QI4UsollVNN2ZxUOw/JgaPTK9+0QA?= =?us-ascii?Q?NpuxbiOk9rK0R929pQyqbBOswB3qWH3uyKbB0ZeW+H1e/vbXRKbGJjLIaeCD?= =?us-ascii?Q?PvuwrhkdQl2bJgNFKUY0iGSNGytgu9DCdsK33PZb1o/LZrE/p6KTbajh1OyA?= =?us-ascii?Q?RHMF8q+jpnm8aisHLNNKPcImV7J6fBvXxKsHlbBTD961Nu087yKfXyoeoA5O?= =?us-ascii?Q?ciqdmA6A4sSaYvEpk8p4Rdqr/gDB/zEU9Iy7oGkpot6YuWzesCWUi37R8jlI?= =?us-ascii?Q?/kyg1BzOfq6s++ulet+QxYFnepnVX2ynClTOXUaoguWm5n+SWItGdP90t3ih?= =?us-ascii?Q?lytVY6xPqwKT77JK4DD3q4SvWAUeFqf0ZbME0RPXa+3wMdyWZfKhKbW0uie7?= =?us-ascii?Q?9iEUKGJEsrj+JA10iJ3GNgvmKCgDv08mbnbgWIWjR0gjYVDG8bjfmWSCLkJk?= =?us-ascii?Q?dYibWSoijLX4qA0owLp1Oy/6wFznyiOO927b4tU1kU+iYIcd/P4cnKs8sfFW?= =?us-ascii?Q?pslaFjRCQ/vdbeLJeNVYLuipKMhi3I6ruevsN2X7386ELDAFa0rabCSI0aZ2?= =?us-ascii?Q?xkqFsV2l6NWzo5ufZpITe08rYLWMPlX1R3Bve+jeeeT6oMRAU7RTfVXHw+e7?= =?us-ascii?Q?iCCdGwYGVzWziPoBl6qV+YQNbA0KqGWYVMDDo88YKRX9/K8N29m7VGpr/aNY?= =?us-ascii?Q?ANqTJ5p1yAX6W6nHMZvT0snVIt27tnMohdQjGpyMqWUutSRFcpUcRNFMx7Lb?= =?us-ascii?Q?hTNt13r/vv2Rs5ZDvifeKSvJnFE0G0vtdoAc3/NIiRAe6pxD2foA82Wf57uN?= =?us-ascii?Q?N95qf5Q/Pg1J2pNHH3yXA1rsq3ILAM9MS2zs79OUNtx9gYqLPNKqf4WSCmU4?= =?us-ascii?Q?gyQ1BefGxZED7o/uAxp6mTTfo2cx3CvPrdwrxERJPs/lHI1kScte6dP5nBJb?= =?us-ascii?Q?ZKuwid5yGC1T3m7dKhRY8M5Kswfq5S3u6Bbb8BkTNfapik2dXRc82OZCDgFd?= =?us-ascii?Q?YpWEUDbuA8n6vPTkS+cCNnTZiES0PkD54rpm1mE3LfaJX84uluGvl6hfUvWt?= =?us-ascii?Q?LwA24YjMDjvAsS9q4wnnhcOi/w8cYxes9dbpcuaLxr+FP7aP98TqGtnDyzH0?= =?us-ascii?Q?uXbH5cS4wswaL+nCRJ27xB/wR+VkSS3r5Wuy65a8pEB2TZ6MCwLPa7C60avN?= =?us-ascii?Q?qRtsOBClwaqnh5aVn5qoXCZeY9ZuIujG58YBkh3WRl6Ar2PiOZr6G5JzLLn6?= =?us-ascii?Q?mVsKY+SePy+mNMh5xY6tawysms41NkmFMwBpUpGLw0wCy0BNmZKYhX85Vxlw?= =?us-ascii?Q?fsymjB04uQt6/MiKcB3pnpIA9VpQMk0Wq6NyKhPKpo5WM1JcndrEog3kx/ER?= =?us-ascii?Q?Ta/0wtC0gSqVDSuQWLAFSi4DENuC9BDIILK3Qc4of1bB8Ckfp/5cfL6jsHYB?= =?us-ascii?Q?9SarDjoVi7dh9upzrFzUCzQdO08jReU=3D?= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: fb78b078-5654-40a5-d164-08df2f79a518 X-MS-Exchange-CrossTenant-AuthSource: AM7PR10MB3956.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Oct 2026 13:46:01.8714 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: gbT5B4Sr/AWBspYBQE5CaCflQOHrjjN9tfjWikmPXcSp+o0bJUfGsPCs6H3kHX6EW65RvjjsAeAGkhmJNbxNy3h+CUbxEyPZYzOie5TNqnY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAWPR10MB7771 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=r5VP6vLy; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: Ql+xqWlFhGIN In rootless mode, no sudo calls must be made. However, the kas-container ships passwordless sudo which also works in the container. To catch the cases where sudo is called in rootless mode, we replace it in the container entrypoint of the test container with a stub that emits a meaningfull error message along with a non zero exit code. Signed-off-by: Felix Moessbauer --- A similar approach could be implemented in the gitlab CI executor as well. Felix testsuite/dockerdata/test-container-entrypoint | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint index d263760d..ba824760 100755 --- a/testsuite/dockerdata/test-container-entrypoint +++ b/testsuite/dockerdata/test-container-entrypoint @@ -65,14 +65,16 @@ case "$args" in ;; esac +block_sudo=0 case "$args" in *"-p rootless=1"*) + block_sudo=1 ;; *) clean_rootless_files=0 ;; esac -export clean_rootless_files +export clean_rootless_files block_sudo mkdir /isar @@ -109,6 +111,19 @@ mkdir -p ${base_dir}/overlay/work sudo mount -t overlay overlay -o lowerdir=/repo,upperdir=${base_dir}/overlay/upper,workdir=${base_dir}/overlay/work /isar sudo mount -o bind ${base_dir} /isar/build +if [ "${block_sudo}" = 1 ]; then + blocker=$(mktemp) + cat < "${blocker}" +#!/bin/sh +echo "ERROR: sudo is blocked in rootless test runs: sudo \$*" >&2 +exit 1 +EOF + sudo install -m 755 -o root -g root "${blocker}" /usr/bin/sudo.blocked + rm -f "${blocker}" + # rename, as the running sudo binary cannot be overwritten in place + sudo mv -f /usr/bin/sudo.blocked /usr/bin/sudo +fi + mkdir -p "${HOME}"/.config/avocado cat < "${HOME}"/.config/avocado/avocado.conf [datadir.paths] -- 2.55.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20261021134540.331832-1-felix.moessbauer%40siemens.com.